Loaded Before Anything Else

Practise removing a preload registration in this guided exercise. /etc/ld.so.preload loads the libraries it names into dynamically linked programs. This box uses an inert copy of a system library to demonstrate that mechanism: it does not hide files or processes, intercept commands, or collect data. Read the registration, remove both the registration and the demonstration library, and recover the flag from the exercise note.

Record your findings under /root/case:

1. Record the full path of the preloaded library to /root/case/finding.txt. (Read /etc/ld.so.preload — it names the library.)

2. Neutralize it: clear the registration (: > /etc/ld.so.preload or remove the file) AND remove the library file itself, so nothing force-loads it anymore.

3. Recover the flag from the note the intruder left in root's home to /root/case/flag.txt.

See /root/case/brief.txt. Grading reads the filesystem directly.